Analysis

  • max time kernel
    239s
  • max time network
    303s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-02-2023 01:00

General

  • Target

    bc080be46ac6e8aaff225091e2afdb6074fed20e30d30e1ad018f58a1e1901b7.exe

  • Size

    11KB

  • MD5

    14fec5297bef8c5fa6d3f0f5934dea32

  • SHA1

    5549beb12b3635e878b174ae93d47a147e2f6d98

  • SHA256

    bc080be46ac6e8aaff225091e2afdb6074fed20e30d30e1ad018f58a1e1901b7

  • SHA512

    a7889770f7bed2ed2aff36c67cda577cd0ebc064c93532d425d0207bb60f55ee474d6e433402b86704d3f80e442209df53f0bd885d5fcd72b5b229ff5697fda6

  • SSDEEP

    192:cliHh1RDurJEC+88OSM4+pmqQcNM2YDM:cG1d2JEC+lKFI

Malware Config

Extracted

Family

purecrypter

C2

https://vinosbiodinamicos.com/Wnsixjk.bmp

Signatures

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bc080be46ac6e8aaff225091e2afdb6074fed20e30d30e1ad018f58a1e1901b7.exe
    "C:\Users\Admin\AppData\Local\Temp\bc080be46ac6e8aaff225091e2afdb6074fed20e30d30e1ad018f58a1e1901b7.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4732
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 1968
      2⤵
      • Program crash
      PID:4264
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4732 -ip 4732
    1⤵
      PID:3652

    Network

    • flag-us
      DNS
      vinosbiodinamicos.com
      bc080be46ac6e8aaff225091e2afdb6074fed20e30d30e1ad018f58a1e1901b7.exe
      Remote address:
      8.8.8.8:53
      Request
      vinosbiodinamicos.com
      IN A
      Response
      vinosbiodinamicos.com
      IN A
      92.52.217.24
    • flag-us
      DNS
      151.122.125.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      151.122.125.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      103.169.127.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      103.169.127.40.in-addr.arpa
      IN PTR
      Response
    • 204.79.197.200:443
      40 B
      1
    • 204.79.197.200:443
      40 B
      1
    • 93.184.221.240:80
      260 B
      5
    • 93.184.220.29:80
      322 B
      7
    • 93.184.221.240:80
      322 B
      7
    • 93.184.221.240:80
      322 B
      7
    • 20.42.65.89:443
      322 B
      7
    • 104.80.225.205:443
      322 B
      7
    • 93.184.221.240:80
      322 B
      7
    • 93.184.221.240:80
      322 B
      7
    • 52.152.110.14:443
      260 B
      5
    • 52.152.110.14:443
      260 B
      5
    • 52.152.110.14:443
      260 B
      5
    • 92.52.217.24:443
      vinosbiodinamicos.com
      tls
      bc080be46ac6e8aaff225091e2afdb6074fed20e30d30e1ad018f58a1e1901b7.exe
      735 B
      5.6kB
      8
      9
    • 92.52.217.24:443
      vinosbiodinamicos.com
      tls
      bc080be46ac6e8aaff225091e2afdb6074fed20e30d30e1ad018f58a1e1901b7.exe
      932 B
      5.9kB
      10
      11
    • 8.8.8.8:53
      vinosbiodinamicos.com
      dns
      bc080be46ac6e8aaff225091e2afdb6074fed20e30d30e1ad018f58a1e1901b7.exe
      67 B
      83 B
      1
      1

      DNS Request

      vinosbiodinamicos.com

      DNS Response

      92.52.217.24

    • 8.8.8.8:53
      151.122.125.40.in-addr.arpa
      dns
      73 B
      159 B
      1
      1

      DNS Request

      151.122.125.40.in-addr.arpa

    • 8.8.8.8:53
      103.169.127.40.in-addr.arpa
      dns
      73 B
      147 B
      1
      1

      DNS Request

      103.169.127.40.in-addr.arpa

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4732-132-0x00000000005A0000-0x00000000005A8000-memory.dmp

      Filesize

      32KB

    • memory/4732-133-0x00000000054C0000-0x0000000005A64000-memory.dmp

      Filesize

      5.6MB

    • memory/4732-134-0x0000000004FB0000-0x0000000005042000-memory.dmp

      Filesize

      584KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.